topic Re: Remotely change Solaris universal forwarder admin password in Getting Data In

Remotely change Solaris universal forwarder admin password

adamblock1 — Mon, 02 Jun 2014 00:30:47 GMT

I have somewhere between 20-50 universal forwarders installed on Solaris hosts. I need to change the Splunk admin password on each of these machines, and being that I do not have credentials to logon to each of these hosts, I am curious if this can be done remotely.

Thank you.

Re: Remotely change Solaris universal forwarder admin password

HiroshiSatoh — Mon, 02 Jun 2014 04:02:32 GMT

Do not be changed in the CLI from SPLUNK server?

>splunk edit user admin -password PASSWORD_NEW -auth admin:PASSWORD_OLD -uri https://HOSTNAME:8089

Re: Remotely change Solaris universal forwarder admin password

adamblock1 — Mon, 02 Jun 2014 15:24:00 GMT

The "splunk edit user admin" command works if the default password had been changed. I have found that when these universal forwarders were installed, the default password was never chaged.

Re: Remotely change Solaris universal forwarder admin password

HiroshiSatoh — Tue, 03 Jun 2014 05:23:04 GMT

This command is not usable by the default password.I'm sorry.

Re: Remotely change Solaris universal forwarder admin password

MuS — Tue, 03 Jun 2014 07:53:12 GMT

Hi adamblock1,

One way to do this is using Deployment Server and setup a scripted input. Inside the scripted input, you run the command:

$SPLUNK_HOME/bin/splunk edit user admin -password $NEWPASSWORD -auth admin:changeme

Once this is run, you can delete the input from the forwarders using the Deployment Server.

hope this helps ...

cheers, MuS